If this is your first visit, be sure to
check out the FAQ by clicking the
link above. You may have to register
before you can post: click the register link above to proceed. To start viewing messages,
select the forum that you want to visit from the selection below.

[RESOLVED] IIS settings for secure web access

Greetings,

I'm really struggling with this one, and any suggestions are welcome! My modest suite of in-house developed applications in (eek! I know, and please forgive me) MS Access 2003, running on a Windows 2003 server with IIS 6.0, has run into a major security snag.

In order for integrated authentication to work, and therefore allow or restrict pages, form fields, etc., we've had to allow read and execute access to all our domain users. The issue is that this means they can open the shared folder and browse records at their leisure, should they figure out where to go to open the database files.

Is there any possibility to set up access for domain users to see the web application and pass on their windows credentials, without having to grant any folder access? Or, conversely, can the MS access databases be locked down for shared folder access, while still allowing web application access?

I wish... But no... Since we're using integrated authentication, the individual users apparently need access to the share. Otherwise, they can't open web pages. And they also need write access, or they won't be able to create and update records. Any more hints???

Thanks to intervention from Microsoft (definitely worth the flat fee they charge per incident), we were able to identify the problem. Instead of using the network path to identify the website location on the "Home Directory" tab of the IIS properties, we were using the local drive path. That was all that needed to be changed.

Once we switched to the network path and added a dedicated service account to "Connect As...", impersonation started working right away. Users pass their logged on credentials via integrated authentication (no logon required) and the service account takes care of executing their actions on the database file.

Access to the shared folder is limited to a brief list of administrators, and data access on the web application is limited based on user names.